[Buildroot] [PATCH 2025.02.x] package/util-linux: fix loopdev-fl-nofollow patch

Jasper van der Neut jasper at isotopic.nl
Thu May 7 16:12:30 UTC 2026


ul_canonicalize_path is not available in util-linux 2.40, so build will
fail with an unresolved reference.

Signed-off-by: Jasper van der Neut <jasper at isotopic.nl>
---
 package/util-linux/0006-add-loopdev-fl-nofollow.patch | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/package/util-linux/0006-add-loopdev-fl-nofollow.patch b/package/util-linux/0006-add-loopdev-fl-nofollow.patch
index 21b1e2596c..228c570554 100644
--- a/package/util-linux/0006-add-loopdev-fl-nofollow.patch
+++ b/package/util-linux/0006-add-loopdev-fl-nofollow.patch
@@ -8,7 +8,7 @@ prevents symlink following in both path canonicalization and file open.
 
 When set:
 - loopcxt_set_backing_file() uses strdup() instead of
-  ul_canonicalize_path() (which calls realpath() and follows symlinks)
+  canonicalize_path() (which calls realpath() and follows symlinks)
 - loopcxt_setup_device() adds O_NOFOLLOW to open() flags
 
 The flag is set for non-root (restricted) mount operations in
@@ -28,13 +28,13 @@ Vulnerable Code Flow:
           hook_loopdev.c: setup_loopdev()
             backing_file = fstab source path ("/home/user/disk.img")
             loopcxt_set_backing_file()       <-- calls realpath() as ROOT
-              ul_canonicalize_path()         <-- follows symlinks!
+              canonicalize_path()            <-- follows symlinks!
             loopcxt_setup_device()
               open(lc->filename, O_RDWR|O_CLOEXEC)  <-- no O_NOFOLLOW
 
 Two vulnerabilities in the path:
 
-1) loopcxt_set_backing_file() calls ul_canonicalize_path() which uses
+1) loopcxt_set_backing_file() calls canonicalize_path() which uses
    realpath() -- this follows symlinks as euid=0. If the attacker swaps
    the file to a symlink before this call, lc->filename becomes the
    resolved target path (e.g., /root/secret.img).
@@ -82,7 +82,7 @@ index c72fb2c40..3d2274693 100644
 +	if (lc->flags & LOOPDEV_FL_NOFOLLOW)
 +		lc->filename = strdup(filename);
 +	else
-+		lc->filename = ul_canonicalize_path(filename);
++		lc->filename = canonicalize_path(filename);
  	if (!lc->filename)
  		return -errno;
  
-- 
2.43.0



More information about the buildroot mailing list